Affects
Teams configuring Access Manager SSO, organization-domain matching, or BYOC deployments with the Access Manager Helm chart.
What changed
Pre-login organization matching uses the
domain: tag prefix. For a tenant’s first SSO provider, omitting disablePasswordLogin keeps local password login available until the first successful SSO login, after which Auth disables it. Set the flag explicitly for immediate control. The Helm documentation now lists chart 8.6.0 with Auth and Identity 3.1.0 images.
These documentation updates align with implemented configuration behavior and the published chart matrix. They do not announce a runtime release.
Impact
Classification: Action required. Update SSO configuration and deployment material that expects the former tag prefix or password-login behavior. Do not pin the documented current chart to former image versions.
What you need to do
1
Replace the former organization-domain tag prefix with
domain: where you configure pre-login SSO matching.2
Set
disablePasswordLogin explicitly if password-login availability must be controlled at first-provider setup.3
Review Helm values and compatibility records before upgrading to chart
8.6.0 and Auth or Identity 3.1.0.